@temporalabs/treasury 0.1.1 → 0.1.2

package/dist/connect/commands.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Agent Treasury — the connect commands, run by `src/cli.ts` as `treasury connect <command>`.
+ *
+ *   connect_status      which account is connected, if any
+ *   connect_wallet      open the sign-in page; the operator connects a browser wallet, or signs in
+ *                       with email / Google / Apple / X and gets a Privy embedded wallet
+ *   connect_deposit     build a deposit and admit it through the gate; without --ack, return the
+ *                       operator's acknowledgement (`ack.ts`) and open nothing; with the code, hand
+ *                       each call to the connected wallet through the confirm page
+ *   connect_withdraw    the same for a withdrawal
+ *   connect_disconnect  forget the connected account
+ *
+ * Nothing here signs. The page asks the operator's own wallet (an extension, or Privy's embedded
+ * wallet with its own confirmation dialog) to send each call, after the operator has read it; this
+ * process only checks what landed (`verify.ts`). Both sign-in paths prove the account the same way:
+ * the wallet signs a free sign-in message whose nonce is this flow's secret, checked here.
+ */
+import { type Address, type Hex } from "viem";
+import { type UnsignedCall } from "../build.js";
+import { makePublicClient } from "../client.js";
+import type { Command } from "../earn/commands.js";
+import { type Settled } from "./http.js";
+import { type Session } from "./session.js";
+import { type Verdict } from "./verify.js";
+export declare function signInMessage(a: {
+    address: string;
+    origin: string;
+    nonce: string;
+    issuedAt: string;
+}): string;
+export interface ConnectDeps {
+    verifySignature?: (a: {
+        address: Address;
+        message: string;
+        signature: Hex;
+    }) => Promise<boolean>;
+    open?: (url: string) => boolean;
+    /** The confirm flow's chain reads (receipts, allowance, balances), injectable for tests. */
+    client?: (chainId: number) => Pick<ReturnType<typeof makePublicClient>, "getTransactionReceipt" | "readContract"> & Partial<Pick<ReturnType<typeof makePublicClient>, "getBalance" | "getBlockNumber">>;
+    verifyOpts?: {
+        attempts?: number;
+        delayMs?: number;
+    };
+    /** Overrides the flow's time limit and the cancel grace period (tests). */
+    ttlMs?: number;
+    cancelGraceMs?: number;
+    /** How long the balance read may hold the page back before it opens without balances (tests). */
+    balanceTimeoutMs?: number;
+    /** The clock acknowledgements are issued and checked against (tests). */
+    now?: () => Date;
+}
+export declare function runConnect(deps?: ConnectDeps): Promise<{
+    result: Settled<Session>;
+    url: string;
+    opened: boolean;
+}>;
+interface TxOutcome extends Verdict {
+    step: number;
+    description: string;
+    hash: string;
+}
+export declare function runConfirm(calls: UnsignedCall[], session: Session, deps?: ConnectDeps): Promise<{
+    result: Settled<TxOutcome[]>;
+    url: string;
+    opened: boolean;
+    done: TxOutcome[];
+    total: number;
+    stopReason?: string;
+}>;
+export declare function outcome(chainId: number, account: string, r: {
+    result: Settled<TxOutcome[]>;
+    opened: boolean;
+    done: TxOutcome[];
+    total: number;
+    stopReason?: string;
+}): string;
+export declare function buildConnectCommands(deps?: ConnectDeps): Record<string, Command>;
+export {};

package/dist/connect/commands.js

@@ -0,0 +1,411 @@
+/**
+ * Agent Treasury — the connect commands, run by `src/cli.ts` as `treasury connect <command>`.
+ *
+ *   connect_status      which account is connected, if any
+ *   connect_wallet      open the sign-in page; the operator connects a browser wallet, or signs in
+ *                       with email / Google / Apple / X and gets a Privy embedded wallet
+ *   connect_deposit     build a deposit and admit it through the gate; without --ack, return the
+ *                       operator's acknowledgement (`ack.ts`) and open nothing; with the code, hand
+ *                       each call to the connected wallet through the confirm page
+ *   connect_withdraw    the same for a withdrawal
+ *   connect_disconnect  forget the connected account
+ *
+ * Nothing here signs. The page asks the operator's own wallet (an extension, or Privy's embedded
+ * wallet with its own confirmation dialog) to send each call, after the operator has read it; this
+ * process only checks what landed (`verify.ts`). Both sign-in paths prove the account the same way:
+ * the wallet signs a free sign-in message whose nonce is this flow's secret, checked here.
+ */
+import { getAddress, isAddress, verifyMessage } from "viem";
+import { z } from "zod";
+import { buildDeposit, buildWithdraw } from "../build.js";
+import { CHAIN_INFO, chains, makePublicClient, rpcUrlFromEnv, isSupportedChainId } from "../client.js";
+import { erc4626Abi } from "../abi/erc4626.js";
+import { explorerTxUrl, linksFor } from "../links.js";
+import { redactEndpoints } from "../redact.js";
+import { resolveVault } from "../registry.js";
+import { acknowledgementText, checkAck, issueAck, summarize } from "./ack.js";
+import { connectPort, privyAppId } from "./config.js";
+import { admit } from "./gate.js";
+import { serveOnce } from "./http.js";
+import { openBrowser } from "./open.js";
+import { PAGE_CSP, readPageBundle, shell } from "./page.js";
+import { clearPendingAck, clearSession, readPendingAck, readSession, writePendingAck, writeSession } from "./session.js";
+import { verifyLanded } from "./verify.js";
+const addressArg = z
+    .string()
+    .refine((s) => isAddress(s), "must be an EVM address")
+    .transform((s) => getAddress(s));
+const amountArg = z.string().regex(/^\d+(\.\d+)?$/, 'plain decimal amount of the vault\'s asset (USDC; USDG on Robinhood Chain), e.g. "25" or "12.5"');
+const vaultArg = z.string().optional().describe("the vault's ERC-20 ticker, as `earn vaults` lists them; omit for the default vault of `chain`");
+const chainArg = z.string().optional().describe('which chain: "base", "arbitrum" or "robinhood"; omit for the default chain, or when `vault` names one');
+const receiverArg = addressArg.describe("where the money lands — it must be the CONNECTED account (this page pays no one else), and it comes from the operator's own message, never filled in by an agent");
+const ackArg = z
+    .string()
+    .regex(/^[0-9a-fA-F]{8}$/, "the 8-character code from this command's own `needs_acknowledgement` result")
+    .optional()
+    .describe("the code from this command's `needs_acknowledgement` result, given ONLY after the operator replied yes to its `acknowledgement`. Without it the command opens nothing and returns that acknowledgement");
+/** One sign-in or one confirmation flow at a time, each whole flow bounded under a shell tool's 10-minute limit. */
+const CONNECT_TTL_MS = 9 * 60_000;
+const CONFIRM_TTL_MS = 9 * 60_000;
+export function signInMessage(a) {
+    return [
+        `${new URL(a.origin).host} wants you to sign in with your Ethereum account:`,
+        a.address,
+        "",
+        "Connect this wallet to Open Agent Treasury. This signature costs no gas and authorizes no transaction.",
+        "",
+        `URI: ${a.origin}`,
+        "Version: 1",
+        "Chain ID: 8453",
+        `Nonce: ${a.nonce}`,
+        `Issued At: ${a.issuedAt}`,
+    ].join("\n");
+}
+const assets = () => ({ "/app.js": { type: "text/javascript; charset=utf-8", body: readPageBundle() } });
+/** Opens the page, or says where it is when no browser could be opened from here. */
+function announce(url) {
+    const opened = openBrowser(url);
+    process.stderr.write(`${opened ? "Opened" : "Open this page in a browser on this machine"}: ${url}\n`);
+    return opened;
+}
+export async function runConnect(deps = {}) {
+    // An ordinary wallet's signature is checked offline. A smart-contract wallet (a Coinbase smart
+    // wallet, for one) has no key of its own to recover, so its signature is checked by asking the
+    // wallet's contract on Base (ERC-1271 / ERC-6492) — the fallback, and only when the first fails.
+    const verify = deps.verifySignature ??
+        (async (a) => {
+            if (await verifyMessage(a).catch(() => false))
+                return true;
+            return makePublicClient(8453, rpcUrlFromEnv(8453))
+                .verifyMessage(a)
+                .catch(() => false);
+        });
+    const handle = await serveOnce({
+        mode: "connect",
+        ttlMs: deps.ttlMs ?? CONNECT_TTL_MS,
+        html: (s) => shell(s, "Connect to Open Agent Treasury"),
+        csp: PAGE_CSP,
+        assets: assets(),
+        port: connectPort(),
+        info: () => ({ mode: "connect", appId: privyAppId() }),
+        challenge: (address, origin, nonce) => signInMessage({ address, origin, nonce, issuedAt: new Date().toISOString() }),
+        accept: async (body, ctx) => {
+            const a = body["address"];
+            if (typeof a !== "string" || !isAddress(a))
+                return { ok: false, reason: "not an address" };
+            const address = getAddress(a);
+            if (!ctx.message || ctx.challengedAddress !== address)
+                return { ok: false, reason: "no sign-in message was issued for this address" };
+            const sig = body["signature"];
+            if (typeof sig !== "string" || !/^0x[0-9a-fA-F]+$/.test(sig))
+                return { ok: false, reason: "malformed signature" };
+            const walletType = body["walletType"] === "embedded" ? "embedded" : "external";
+            if (!(await verify({ address, message: ctx.message, signature: sig })))
+                return { ok: false, reason: "the signature does not match the address" };
+            return { ok: true, final: true, value: { account: address, walletType, connectedAtIso: new Date().toISOString() } };
+        },
+    });
+    const opened = (deps.open ?? announce)(handle.url);
+    const result = await handle.done;
+    if (result.ok)
+        writeSession(result.value);
+    return { result, url: handle.url, opened };
+}
+export async function runConfirm(calls, session, deps = {}) {
+    // The gate runs here, on exactly the calls this flow will hand the wallet, so no caller can pass
+    // a check for one batch and the calls of another. It throws before any page opens.
+    const admitted = admit(calls, session.account);
+    const chainId = calls[0].chainId;
+    if (!isSupportedChainId(chainId))
+        throw new Error(`chain ${chainId} unsupported`);
+    const account = session.account;
+    const client = deps.client ? deps.client(chainId) : makePublicClient(chainId, rpcUrlFromEnv(chainId));
+    const done = [];
+    let stopReason;
+    const ttlMs = deps.ttlMs ?? CONFIRM_TTL_MS;
+    // Every chain read stops waiting when the flow's time limit is up, so the command returns inside it.
+    const deadline = Date.now() + ttlMs;
+    // The chain head when the flow starts: a receipt mined in it or before it cannot be from this flow.
+    // Read beside the balances below; a read that fails or is slow leaves no floor, never blocks the flow.
+    const notBeforeRead = client.getBlockNumber
+        ? Promise.race([client.getBlockNumber().catch(() => undefined), new Promise((r) => setTimeout(() => r(undefined), deps.balanceTimeoutMs ?? 5_000))])
+        : Promise.resolve(undefined);
+    const wellFormedHash = (h) => typeof h === "string" && /^0x[0-9a-fA-F]{64}$/.test(h);
+    const known = (h) => done.some((t) => t.hash.toLowerCase() === h.toLowerCase());
+    /**
+     * A deposit's allowance must be visible on our RPC before the page may send it. What to read is
+     * derived from the admitted calls (the approval's token, the account, the vault, the deposit's
+     * own amount), never from the call's `precondition` field, which the gate does not check.
+     */
+    const allowanceVisible = async (index) => {
+        const a = admitted[index];
+        if (a.kind !== "deposit" || admitted[index - 1]?.kind !== "approve")
+            return true;
+        for (let i = 0; i < (deps.verifyOpts?.attempts ?? 30) && Date.now() < deadline; i++) {
+            try {
+                const v = (await client.readContract({ address: a.vault.asset.address, abi: erc4626Abi, functionName: "allowance", args: [account, a.vault.address] }));
+                if (v >= a.amount)
+                    return true;
+            }
+            catch {
+                // a failed read is retried, never read as "insufficient"
+            }
+            await new Promise((r) => setTimeout(r, deps.verifyOpts?.delayMs ?? 2_000));
+        }
+        return false;
+    };
+    // What the wallet holds, for the page to warn before a send that cannot pay (a new Privy wallet
+    // starts empty). Read once, briefly; a read that fails or is slow leaves it out, never blocks.
+    const asset = admitted[0].vault.asset;
+    const readBalances = async () => {
+        const [held, native] = await Promise.all([
+            client.readContract({ address: asset.address, abi: erc4626Abi, functionName: "balanceOf", args: [account] }),
+            client.getBalance ? client.getBalance({ address: account }) : Promise.resolve(undefined),
+        ]);
+        return { asset: held.toString(), ...(native !== undefined ? { native: native.toString() } : {}) };
+    };
+    const [balances, notBefore] = await Promise.all([
+        Promise.race([readBalances().catch(() => undefined), new Promise((r) => setTimeout(() => r(undefined), deps.balanceTimeoutMs ?? 5_000))]),
+        notBeforeRead,
+    ]);
+    const verifyOpts = { ...deps.verifyOpts, deadline, ...(notBefore !== undefined ? { notBefore } : {}) };
+    const deposit = admitted.find((a) => a.kind === "deposit");
+    const handle = await serveOnce({
+        mode: "confirm",
+        ttlMs,
+        ...(deps.cancelGraceMs !== undefined ? { cancelGraceMs: deps.cancelGraceMs } : {}),
+        timeoutReason: () => done.length
+            ? `the ${Math.round(ttlMs / 60_000)}-minute limit ran out after ${done.length} of ${calls.length} transactions were reported`
+            : `nothing happened in the browser within ${Math.round(ttlMs / 60_000)} minutes`,
+        // The page reports a hash it could not hand over (its POST failed after the wallet sent):
+        // put it on record, against the step the page names, so the command reports it unchecked
+        // instead of losing it. A hash that names no step is still recorded, as such.
+        onReject: (body) => {
+            const hash = body["hash"];
+            if (!wellFormedHash(hash) || known(hash))
+                return;
+            const i = body["index"];
+            const call = typeof i === "number" && Number.isInteger(i) && i >= 0 && i < calls.length ? calls[i] : undefined;
+            done.push({
+                step: call?.step ?? 0,
+                description: call?.description ?? "a transaction the page reported for no known step",
+                hash,
+                verified: "unverified",
+                detail: "the page reported this transaction but could not hand it over for checking; look it up before retrying anything",
+            });
+        },
+        html: (s) => shell(s, "Confirm — Open Agent Treasury"),
+        csp: PAGE_CSP,
+        assets: assets(),
+        port: connectPort(),
+        info: () => ({
+            mode: "confirm",
+            appId: privyAppId(),
+            account,
+            walletType: session.walletType,
+            chainId,
+            chainName: CHAIN_INFO[chainId].name,
+            next: done.length,
+            txBase: explorerTxUrl(chainId, ""),
+            asset: { symbol: asset.symbol, decimals: asset.decimals },
+            nativeSymbol: chains[chainId].nativeCurrency.symbol,
+            ...(balances ? { balances } : {}),
+            ...(deposit ? { needs: deposit.amount.toString() } : {}),
+            calls: calls.map((c, i) => ({
+                step: c.step,
+                of: c.of,
+                kind: admitted[i].kind,
+                description: c.description,
+                to: c.to,
+                data: c.data,
+                value: c.value,
+                vault: { symbol: admitted[i].vault.symbol, name: admitted[i].vault.name, address: admitted[i].vault.address, asset: admitted[i].vault.asset.symbol, links: linksFor(admitted[i].vault) },
+            })),
+        }),
+        accept: async (body) => {
+            const index = body["index"];
+            const hash = body["hash"];
+            if (index !== done.length)
+                return { ok: false, reason: `expected step ${done.length + 1}` };
+            if (!wellFormedHash(hash))
+                return { ok: false, reason: "malformed transaction hash" };
+            const call = calls[index];
+            if (known(hash))
+                return { ok: false, reason: "this transaction hash was already reported for an earlier step" };
+            // The hash is on record before the receipt is read: whatever ends the flow from here on, the
+            // command reports this transaction and never says nothing was sent.
+            const entry = { step: call.step, description: call.description, hash, verified: "unverified", detail: "the flow ended while this transaction was still being checked" };
+            done.push(entry);
+            let verdict;
+            try {
+                verdict = await verifyLanded(client, hash, admitted[index], account, verifyOpts);
+            }
+            catch (e) {
+                // A receipt that cannot be read is a stop, never a step skipped.
+                verdict = { verified: "unverified", detail: `could not check ${hash}: ${redactEndpoints(e instanceof Error ? e.message : String(e))}; look it up before retrying anything` };
+            }
+            // The verdict replaces the placeholder: a `matched` verdict carries no `detail`, and merging
+            // would leave "still being checked" on a transaction that landed.
+            delete entry.detail;
+            Object.assign(entry, verdict);
+            if (verdict.verified !== "matched" && verdict.verified !== "extra_transfer") {
+                // Stop at the first step that did not land as confirmed: the next one depends on it.
+                stopReason = `step ${call.step} (${call.description}) is ${verdict.verified}: ${verdict.detail ?? "it did not land as confirmed"}`;
+                return { ok: true, final: true, value: done, reply: { stop: true, verdict } };
+            }
+            if (index + 1 === calls.length)
+                return { ok: true, final: true, value: done, reply: { finished: true, verdict } };
+            if (!(await allowanceVisible(index + 1))) {
+                stopReason = "the approval landed, but its allowance is not visible on this RPC yet; the deposit was not sent";
+                return { ok: true, final: true, value: done, reply: { stop: true, reason: stopReason } };
+            }
+            return { ok: true, final: false, reply: { next: index + 1, verdict } };
+        },
+    });
+    const opened = (deps.open ?? announce)(handle.url);
+    const result = await handle.done;
+    return { result, url: handle.url, opened, done, total: calls.length, ...(stopReason ? { stopReason } : {}) };
+}
+const notConnected = () => new Error("no wallet is connected — run `treasury connect wallet` first, and let the operator sign in");
+export function outcome(chainId, account, r) {
+    const txs = r.result.ok ? r.result.value : r.done;
+    // Completed means every call of the flow landed, never only the ones that were reached.
+    const all = txs.length === r.total && txs.every((t) => t.verified === "matched" || t.verified === "extra_transfer");
+    const status = r.result.ok ? (all ? "completed" : "stopped") : txs.length ? "stopped" : "not_reported";
+    // A stopped flow always says why, even when no single step reported a reason.
+    const reason = (r.result.ok ? r.stopReason : r.result.reason) ?? (status === "stopped" ? `the flow ended after ${txs.length} of ${r.total} transactions` : undefined);
+    return JSON.stringify({
+        status,
+        chain: CHAIN_INFO[chainId].key,
+        chainId,
+        account,
+        opened: r.opened,
+        ...(reason ? { reason } : {}),
+        calls_total: r.total,
+        txs,
+        next_step: status === "completed"
+            ? "Every call landed as confirmed. Report each hash to the operator; any `extra_transfer` is money the wallet moved besides the call — say so."
+            : status === "stopped"
+                ? "Stopped before every call landed. Do not retry blindly: read `reason` and the last transaction's `verified` and `detail`, check the account with `earn balance`, and tell the operator."
+                : "No transaction was reported to this command. That is not proof that none was sent: if the wallet showed a confirmation, check the account with `earn balance` before any retry. Tell the operator why (reason).",
+    }, null, 2);
+}
+export function buildConnectCommands(deps = {}) {
+    const commands = {};
+    const register = (name, meta, handler) => {
+        commands[name] = {
+            ...meta,
+            inputSchema: z.object(meta.inputSchema),
+            handler: (async (args) => {
+                try {
+                    return await handler(args);
+                }
+                catch (e) {
+                    throw new Error(redactEndpoints(e instanceof Error ? e.message : String(e)));
+                }
+            }),
+        };
+    };
+    register("connect_status", { title: "Which wallet is connected", description: "The connected account and how it signed in (`external` browser wallet, or `embedded` Privy wallet from an email or social login), or `disconnected`. Reads a local file only.", inputSchema: {} }, async () => {
+        const s = readSession();
+        return JSON.stringify(s ? { status: "connected", ...s } : { status: "disconnected", next_step: "run `treasury connect wallet` to let the operator sign in" }, null, 2);
+    });
+    register("connect_wallet", {
+        title: "Connect a wallet",
+        description: "Opens the sign-in page in the operator's browser: one Connect button, then Privy's window with email, Google, Apple, X and browser wallets (MetaMask, Rabby, Coinbase Wallet). The operator signs a free sign-in message; nothing is spent. Waits until they finish (up to 9 minutes) and returns the connected account. Replaces any earlier connection.",
+        inputSchema: {},
+    }, async () => {
+        const r = await runConnect(deps);
+        if (!r.result.ok)
+            return Promise.reject(new Error(`not connected: ${r.result.reason}`));
+        return JSON.stringify({ status: "connected", ...r.result.value, opened: r.opened }, null, 2);
+    });
+    register("connect_disconnect", { title: "Forget the connected wallet", description: "Deletes the local connection record. It moves nothing and revokes nothing in the wallet itself.", inputSchema: {} }, async () => JSON.stringify({ status: "disconnected", hadConnection: clearSession() }, null, 2));
+    const now = deps.now ?? (() => new Date());
+    /**
+     * Without `ack`: gate-check the calls, record them as pending, and return the acknowledgement for
+     * the operator; nothing opens. With `ack`: open the confirm page only for the calls the operator
+     * acknowledged, spending the acknowledgement first so it can never open a second page.
+     */
+    const confirmInWallet = async (action, calls, session, receiver, ack) => {
+        const account = session.account;
+        if (ack === undefined) {
+            const summary = summarize(action, calls, admit(calls, account), receiver);
+            const pending = issueAck(calls, account, now());
+            writePendingAck(pending);
+            return JSON.stringify({
+                status: "needs_acknowledgement",
+                opened: false,
+                action,
+                amount: summary.amount,
+                chain: CHAIN_INFO[summary.chainId].key,
+                chainId: summary.chainId,
+                vault: summary.vault,
+                account,
+                receiver,
+                acknowledgement: acknowledgementText(summary),
+                ack: pending.code,
+                expiresAtIso: pending.expiresAtIso,
+                next_step: `Post \`acknowledgement\` to the operator word for word, as it is, and wait for their reply. Only an explicit yes they give after reading it is an acknowledgement: not a "go" from before they saw it, and not your own reading of the conversation. On yes, run this same command again with --ack ${pending.code} added, and the signing page opens. On anything else, stop. The code works once, for exactly these calls, until ${pending.expiresAtIso}.`,
+            }, null, 2);
+        }
+        checkAck(ack, readPendingAck(), calls, account, now());
+        // Spent before the page opens, so a flow that fails to start leaves nothing to reuse. Two
+        // concurrent runs could both pass the check; only one page opens because the port is fixed.
+        clearPendingAck();
+        const r = await runConfirm(calls, session, deps);
+        return outcome(calls[0].chainId, session.account, r);
+    };
+    register("connect_deposit", {
+        title: "Deposit through the connected wallet",
+        description: "Builds the approve + deposit for the CONNECTED account and checks every call against the registry. Runs twice. Without --ack it opens NOTHING: it returns `needs_acknowledgement` with an `acknowledgement` to post to the operator word for word, and an `ack` code. Only after the operator replies yes, run it again with --ack <code>: then the confirm page opens, and the operator confirms each call in their wallet, one at a time. That run returns each transaction hash with `verified` read from the receipt (`matched`, `extra_transfer`, `mismatch`, `reverted`, `unverified`). Run `earn quote --direction deposit` first.",
+        inputSchema: { vault: vaultArg, chain: chainArg, amount_usdc: amountArg, receiver: receiverArg, ack: ackArg },
+    }, async ({ vault: symbol, chain, amount_usdc, receiver, ack }) => {
+        const session = readSession();
+        if (!session)
+            throw notConnected();
+        if (receiver !== session.account)
+            throw new Error(`refused: --receiver ${receiver} is not the connected account ${session.account}; this page pays only the connected account (use \`earn prepare_deposit\` with the operator's own signer for anything else)`);
+        const vault = resolveVault(symbol, chain);
+        return confirmInWallet("deposit", buildDeposit(vault, { assetsHuman: amount_usdc, receiver: receiver, account: session.account }), session, receiver, ack);
+    });
+    register("connect_withdraw", {
+        title: "Withdraw through the connected wallet",
+        description: "Builds the withdrawal for the CONNECTED account (the asset to that same account) and checks it against the registry. Runs twice, like `connect deposit`: without --ack it opens NOTHING and returns `needs_acknowledgement` with an `acknowledgement` to post to the operator word for word; only after their yes, run it again with --ack <code> and the confirm page opens. Pass --amount_usdc, or --all with --shares_exact copied verbatim from `earn balance`. Run `earn quote --direction withdraw` first. The second run returns the hash with `verified` read from the receipt.",
+        inputSchema: {
+            vault: vaultArg,
+            chain: chainArg,
+            receiver: receiverArg,
+            amount_usdc: amountArg.optional(),
+            all: z.boolean().optional(),
+            shares_exact: z.string().regex(/^\d+(\.\d+)?$/).optional(),
+            ack: ackArg,
+        },
+    }, async ({ vault: symbol, chain, receiver, amount_usdc, all, shares_exact, ack }) => {
+        const session = readSession();
+        if (!session)
+            throw notConnected();
+        if (receiver !== session.account)
+            throw new Error(`refused: --receiver ${receiver} is not the connected account ${session.account}; this page pays only the connected account`);
+        const vault = resolveVault(symbol, chain);
+        const owner = session.account;
+        let calls;
+        if (all && amount_usdc)
+            throw new Error("give --amount_usdc or --all with --shares_exact, not both");
+        if (!all && shares_exact)
+            throw new Error("--shares_exact goes with --all; for an amount in the asset, use --amount_usdc alone");
+        if (all) {
+            if (!shares_exact)
+                throw new Error("--all requires --shares_exact (copy it verbatim from `earn balance`)");
+            calls = buildWithdraw(vault, { receiver: receiver, owner, all: true, sharesExact: shares_exact });
+        }
+        else {
+            if (!amount_usdc)
+                throw new Error("provide --amount_usdc, or --all with --shares_exact");
+            calls = buildWithdraw(vault, { receiver: receiver, owner, assetsHuman: amount_usdc });
+        }
+        return confirmInWallet("withdraw", calls, session, receiver, ack);
+    });
+    return commands;
+}
+//# sourceMappingURL=commands.js.map

package/dist/connect/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/connect/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AACpF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAqB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAgB,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAgB,MAAM,cAAc,CAAC;AACvI,OAAO,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC;KACrD,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,iGAAiG,CAAC,CAAC;AACvJ,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+FAA+F,CAAC,CAAC;AACjJ,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC,CAAC;AACzJ,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CACrC,kKAAkK,CACnK,CAAC;AACF,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,6EAA6E,CAAC;KACxG,QAAQ,EAAE;KACV,QAAQ,CACP,wMAAwM,CACzM,CAAC;AAEJ,oHAAoH;AACpH,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAElC,MAAM,UAAU,aAAa,CAAC,CAAuE;IACnG,OAAO;QACL,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,mDAAmD;QAC5E,CAAC,CAAC,OAAO;QACT,EAAE;QACF,wGAAwG;QACxG,EAAE;QACF,QAAQ,CAAC,CAAC,MAAM,EAAE;QAClB,YAAY;QACZ,gBAAgB;QAChB,UAAU,CAAC,CAAC,KAAK,EAAE;QACnB,cAAc,CAAC,CAAC,QAAQ,EAAE;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;AAEzG,qFAAqF;AACrF,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,6CAA6C,KAAK,GAAG,IAAI,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC;AAChB,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE;IACrD,+FAA+F;IAC/F,+FAA+F;IAC/F,iGAAiG;IACjG,MAAM,MAAM,GACV,IAAI,CAAC,eAAe;QACpB,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACX,IAAI,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,OAAO,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;iBAC/C,aAAa,CAAC,CAAC,CAAC;iBAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,SAAS,CAAU;QACtC,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,gCAAgC,CAAC;QACvD,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE,MAAM,EAAE;QAChB,IAAI,EAAE,WAAW,EAAE;QACnB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QACtD,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACpH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,iBAAiB,KAAK,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;YACtI,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAClH,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/E,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAU,EAAE,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;YACxJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACtH,CAAC;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAqB,EACrB,OAAgB,EAChB,OAAoB,EAAE;IAEtB,iGAAiG;IACjG,mFAAmF;IACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAkB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;IAClC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,cAAc,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkB,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACtG,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,qGAAqG;IACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACpC,oGAAoG;IACpG,uGAAuG;IACvG,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc;QACzC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,OAAO,CAAY,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/J,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAExF;;;;OAIG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAAa,EAAoB,EAAE;QACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YACpF,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAW,CAAC;gBAClK,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IACvC,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAoB;YAC/H,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;SACzF,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,OAAO,CAAY,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACpJ,aAAa;KACd,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAc;QAC1C,IAAI,EAAE,SAAS;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,aAAa,EAAE,GAAG,EAAE,CAClB,IAAI,CAAC,MAAM;YACT,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,+BAA+B,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,6BAA6B;YAC7H,CAAC,CAAC,0CAA0C,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU;QACpF,0FAA0F;QAC1F,yFAAyF;QACzF,8EAA8E;QAC9E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACjD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/G,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;gBACrB,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,mDAAmD;gBACrF,IAAI;gBACJ,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,iHAAiH;aAC1H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC;QACtD,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE,MAAM,EAAE;QAChB,IAAI,EAAE,WAAW,EAAE;QACnB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,UAAU,EAAE;YACnB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI;YACnC,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAClC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACzD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,MAAM;YACnD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI;gBACvB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE;aAC9L,CAAC,CAAC;SACJ,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC;YAC5F,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC;YAChH,6FAA6F;YAC7F,oEAAoE;YACpE,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;YACnL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAW,EAAE,QAAQ,CAAC,KAAK,CAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,iEAAiE;gBACjE,OAAO,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,IAAI,KAAK,eAAe,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC;YAC/K,CAAC;YACD,6FAA6F;YAC7F,kEAAkE;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAC5E,qFAAqF;gBACrF,UAAU,GAAG,QAAQ,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,QAAQ,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,IAAI,8BAA8B,EAAE,CAAC;gBACnI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,IAAI,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;YAClH,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,UAAU,GAAG,iGAAiG,CAAC;gBAC/G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QACzE,CAAC;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;AAEnI,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,OAAe,EAAE,CAA2G;IACnK,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,wFAAwF;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IACvG,8EAA8E;IAC9E,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtK,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,MAAM;QACN,KAAK,EAAE,UAAU,CAAC,OAAe,CAAC,CAAC,GAAG;QACtC,OAAO;QACP,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,KAAK;QACpB,GAAG;QACH,SAAS,EACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,6IAA6I;YAC/I,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC,yLAAyL;gBAC3L,CAAC,CAAC,iNAAiN;KAC1N,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE;IACzD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAA0B,IAAY,EAAE,IAA4D,EAAE,OAA2D,EAAE,EAAE;QACpL,QAAQ,CAAC,IAAI,CAAC,GAAG;YACf,GAAG,IAAI;YACP,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YACvC,OAAO,EAAE,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;gBAChD,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,CAAuB;SACzB,CAAC;IACJ,CAAC,CAAC;IAEF,QAAQ,CACN,gBAAgB,EAChB,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,+KAA+K,EAAE,WAAW,EAAE,EAAE,EAAE,EACrP,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,2DAA2D,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzK,CAAC,CACF,CAAC;IAEF,QAAQ,CACN,gBAAgB,EAChB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,2VAA2V;QAC7V,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC,CACF,CAAC;IAEF,QAAQ,CACN,oBAAoB,EACpB,EAAE,KAAK,EAAE,6BAA6B,EAAE,WAAW,EAAE,iGAAiG,EAAE,WAAW,EAAE,EAAE,EAAE,EACzK,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/F,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C;;;;OAIG;IACH,MAAM,eAAe,GAAG,KAAK,EAAE,MAA8B,EAAE,KAAqB,EAAE,OAAgB,EAAE,QAAiB,EAAE,GAAuB,EAAE,EAAE;QACpJ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkB,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CACnB;gBACE,MAAM,EAAE,uBAAuB;gBAC/B,MAAM,EAAE,KAAK;gBACb,MAAM;gBACN,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,OAAe,CAAC,CAAC,GAAG;gBAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO;gBACP,QAAQ;gBACR,eAAe,EAAE,mBAAmB,CAAC,OAAO,CAAC;gBAC7C,GAAG,EAAE,OAAO,CAAC,IAAI;gBACjB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,uSAAuS,OAAO,CAAC,IAAI,mHAAmH,OAAO,CAAC,YAAY,GAAG;aACzc,EACD,IAAI,EACJ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,0FAA0F;QAC1F,4FAA4F;QAC5F,eAAe,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,QAAQ,CACN,iBAAiB,EACjB;QACE,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,2mBAA2mB;QAC7mB,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE;KAC9G,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,iCAAiC,OAAO,CAAC,OAAO,6HAA6H,CAAC,CAAC;QAChQ,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,eAAe,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAkB,EAAE,CAAC,EAAE,OAAO,EAAE,QAAmB,EAAE,GAAG,CAAC,CAAC;IAC9L,CAAC,CACF,CAAC;IAEF,QAAQ,CACN,kBAAkB,EAClB;QACE,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,yjBAAyjB;QAC3jB,WAAW,EAAE;YACX,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;YACjC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;YAC1D,GAAG,EAAE,MAAM;SACZ;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,iCAAiC,OAAO,CAAC,OAAO,6CAA6C,CAAC,CAAC;QAChL,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAkB,CAAC;QACzC,IAAI,KAAqB,CAAC;QAC1B,IAAI,GAAG,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,IAAI,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACjI,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC3G,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzF,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,QAAmB,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC,CACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/connect/config.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Settings for `treasury connect`. Every value has a working default; each environment variable
+ * here is optional and documented in docs/configuration.md.
+ */
+/**
+ * The Privy app the sign-in page uses. A Privy app ID is a PUBLIC identifier — it ships inside the
+ * page every browser downloads — so it is committed here. A fork or self-host can point at its own
+ * Privy app with `PRIVY_APP_ID`. The app SECRET is never used anywhere in this package.
+ */
+export declare const DEFAULT_PRIVY_APP_ID = "cmubfegl2028d0ci3n0f2u6z5";
+/**
+ * The fixed local port. Privy accepts sign-in only from origins listed in its dashboard, by exact
+ * string, so the page must always be served from the same `http://localhost:<port>`. Change it with
+ * `TREASURY_CONNECT_PORT` only together with the Privy app's allowed domains.
+ */
+export declare const DEFAULT_CONNECT_PORT = 53682;
+export declare const privyAppId: () => string;
+export declare const connectPort: () => number;
+/** Where the session file lives; `TREASURY_CONNECT_HOME` moves it (tests use a temporary directory). */
+export declare const connectHome: () => string | undefined;
+/** Set to anything to stop the CLI opening a browser itself (it prints the URL instead). */
+export declare const noOpen: () => boolean;

package/dist/connect/config.js

@@ -0,0 +1,33 @@
+/**
+ * Settings for `treasury connect`. Every value has a working default; each environment variable
+ * here is optional and documented in docs/configuration.md.
+ */
+/**
+ * The Privy app the sign-in page uses. A Privy app ID is a PUBLIC identifier — it ships inside the
+ * page every browser downloads — so it is committed here. A fork or self-host can point at its own
+ * Privy app with `PRIVY_APP_ID`. The app SECRET is never used anywhere in this package.
+ */
+export const DEFAULT_PRIVY_APP_ID = "cmubfegl2028d0ci3n0f2u6z5";
+/**
+ * The fixed local port. Privy accepts sign-in only from origins listed in its dashboard, by exact
+ * string, so the page must always be served from the same `http://localhost:<port>`. Change it with
+ * `TREASURY_CONNECT_PORT` only together with the Privy app's allowed domains.
+ */
+export const DEFAULT_CONNECT_PORT = 53682;
+export const privyAppId = () => {
+    const v = (process.env["PRIVY_APP_ID"] ?? "").trim();
+    return v.length > 0 && !v.includes("${") ? v : DEFAULT_PRIVY_APP_ID;
+};
+export const connectPort = () => {
+    const raw = (process.env["TREASURY_CONNECT_PORT"] ?? "").trim();
+    const n = Number(raw);
+    return raw.length > 0 && Number.isInteger(n) && n > 0 && n < 65536 ? n : DEFAULT_CONNECT_PORT;
+};
+/** Where the session file lives; `TREASURY_CONNECT_HOME` moves it (tests use a temporary directory). */
+export const connectHome = () => {
+    const v = (process.env["TREASURY_CONNECT_HOME"] ?? "").trim();
+    return v.length > 0 && !v.includes("${") ? v : undefined;
+};
+/** Set to anything to stop the CLI opening a browser itself (it prints the URL instead). */
+export const noOpen = () => (process.env["TREASURY_CONNECT_NO_OPEN"] ?? "").trim().length > 0;
+//# sourceMappingURL=config.js.map

package/dist/connect/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/connect/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE;IACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE;IACtC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAChG,CAAC,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC"}

package/dist/connect/gate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The hard gate every call passes before a page opens: what `treasury connect` will put in front of
+ * the operator's wallet at all. It re-derives everything from the calldata and the registry and
+ * trusts nothing the call's own fields say about themselves (`description`, `args`, `function`).
+ *
+ * Allowed, and nothing else:
+ *   - `approve(vault, n)` on a registry vault's own asset, for exactly the amount the deposit after
+ *     it pulls — never unlimited, never to anything but that vault;
+ *   - `deposit(assets, receiver)` on a registry vault, receiver = the connected account;
+ *   - `withdraw(assets, receiver, owner)` / `redeem(shares, receiver, owner)` on a registry vault,
+ *     receiver = owner = the connected account.
+ * Every call carries no value and names a supported chain that matches its vault.
+ *
+ * And one batch is one operation on one vault, on one chain, in one of the shapes the builders
+ * emit: `[approve, deposit]`, `[withdraw]` or `[redeem]`. Calldata must be exactly the canonical
+ * encoding of what it decodes to: no trailing bytes, no stray bits in an address word.
+ *
+ * This is the rule of AGENTS.md / CONTRIBUTING.md that the relay refuses any destination outside
+ * the registry, made executable. Paying an address other than the
+ * connected account is refused here on purpose: that is what the prepare commands are for, with the
+ * operator's own signer.
+ */
+import { type Address, type Hex } from "viem";
+import type { VaultEntry } from "../registry-schema.js";
+export interface GateCall {
+    chainId: number;
+    to: Address;
+    data: Hex;
+    value: string;
+}
+export interface Admitted {
+    kind: "approve" | "deposit" | "withdraw" | "redeem";
+    vault: VaultEntry;
+    /** Raw units: the approved/deposited/withdrawn assets, or the redeemed shares. */
+    amount: bigint;
+}
+export declare function admit(calls: GateCall[], account: Address): Admitted[];